Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Zypento Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 1.0.6. This is due to the front-end TOC rendering script reading heading text via `innerText` and inserting it into the page using `innerHTML` without proper sanitization. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-22 | 1 | Disclosure1 |
| 2026-04-23 | 1 | General1 |
| 2026-04-25 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-5820-zypento-blocks-version-1-06-medium-vulnerability-proof-of-concept CVE-2026-5820 #WordPress plugin #vulnerability zypento-blocks #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof‑of‑concept for CVE‑2026‑5820 affecting the Zypento‑Blocks WordPress plugin is made available via a link; no exploitation or remediation details are included.
CVE-2026-5820 The Zypento Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table of Contents block in all versions up to, and including, 1.0.6. This i… https://www.cve.org/CVERecord?id=CVE-2026-5820
Post summary
This is a CVE announcement listing a stored cross‑site scripting flaw in the Zypento Blocks WordPress plugin affecting all versions up to 1.0.6.
CVE-2026-5820 Stored Cross-Site Scripting in Zypento Blocks WordPress Plugin Versions Up To 1.0.6 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-5820
Post summary
The text discloses a stored XSS vulnerability in Zypento Blocks WordPress plugin (v.≤1.0.6) under CVE‑2026‑5820, without providing exploitation details or mitigation guidance.